STIGQter: STIG Summary: BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

The BlackBerry Enterprise Mobility Server (BEMS) must be configured with an inactivity timeout of 15 minutes or less.

DISA Rule

SV-93733r2_rule

Vulnerability Number

V-79027

Group Title

SRG-APP-000516-AS-000237

Rule Version

BEMS-00-013700

Severity

CAT II

CCI(s)

• CCI-002361 - The information system automatically terminates a user session after organization-defined conditions or trigger events requiring session disconnect.

Weight

10

Fix Recommendation

Configure BEMS with an inactivity timeout of 15 minutes or less.

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field and set it to 900 or less (seconds). (Note: “idelTimeout” may be the field and time may be in milliseconds, depending on the version of BEMS. In this case, the value is 900000.)
3. Save the file.
4. Restart the BEMS server.

Check Contents

Verify the BEMS inactivity timeout is set to 15 minutes or less as follows:

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field. (Note: “idelTimeout” may be the field, depending on the version of BEMS)
3. Verify it is set to 900 or less (seconds). (Note: time may be in milliseconds, depending on the version of BEMS. In this case, the value is 900000.)


If the BEMS inactivity timeout is not set to 15 minutes (900 seconds) or less, this is a finding.

Vulnerability Number

V-79027

Documentable

False

Rule Version

BEMS-00-013700

Severity Override Guidance

Verify the BEMS inactivity timeout is set to 15 minutes or less as follows:

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field. (Note: “idelTimeout” may be the field, depending on the version of BEMS)
3. Verify it is set to 900 or less (seconds). (Note: time may be in milliseconds, depending on the version of BEMS. In this case, the value is 900000.)


If the BEMS inactivity timeout is not set to 15 minutes (900 seconds) or less, this is a finding.

Check Content Reference

M

Target Key

3259

Comments